test(e2e): reject continued Hermes consumer builds

[cv]

Summary

Close the remaining Hermes image-consumer validator bypasses identified after #7551 merged. Shell continuations are normalized before the no-rebuild check, and assigned Buildx push values are evaluated case-insensitively. Literal false remains non-writing; true, empty, mixed-case, and dynamic or otherwise nonliteral values are rejected so the consumer cannot hide a rebuild or registry write.

Related Issue

Part of #7451. Follow-up to #7508 and #7551.

Changes

• Normalize Hermes consumer shell continuations before checking for Docker and Buildx builds.
• Detect assigned, mixed-case, and dynamic Buildx registry-push values in the consumer guard.
• Preserve literal --push=false as non-writing.
• Add adversarial regressions for multiline rebuilds and assigned push values.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: the production workflow and documented no-rebuild contract are unchanged; this makes the internal validator enforce that existing contract for continued commands.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: CodeRabbit reproduced the bypass on test(e2e): harden image reuse workflow validator #7551; the exact mutation is now an adversarial test and passes only with normalization at the consumer guard.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: no-docs-needed
• Evidence: At PR SHA 2cef897b4fcba8033d115d94f2dd4c2ae12d86ed, the change only strengthens the repository-internal Hermes image-consumer validator for multiline rebuilds and assigned, mixed-case, or dynamic Buildx push values. Literal --push=false remains non-writing. test/e2e/README.md already documents the no-rebuild/no-registry-write contract. The focused E2E-support suite passed 29/29, the PR workflow-contract suite passed 22/22, and npm run build:cli plus npm run check:diff passed.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed; npm run build:cli and npm run check:diff also passed on exact head 2cef897b4fcba8033d115d94f2dd4c2ae12d86ed.
• Targeted behavior tests pass for the current change set — E2E-support passed 29/29 and the PR workflow-contract suite passed 22/22.
• Applicable broad gate passed — not applicable to this validator/test-only delta; the exact affected suites, CLI build, and complete diff gate passed, and GitHub CI remains required before approval.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Carlos Villela cvillela@nvidia.com

Summary by CodeRabbit

• Bug Fixes
  • Improved sandbox image workflow validation to more precisely detect docker buildx build ... --push commands, including shell line continuations and --push casing/formatting.
  • Strengthened Hermes prebuilt-image reuse checks by normalizing command formatting before validating consumer steps.
• Tests
  • Added new end-to-end negative cases covering consumer attempts to rebuild the prebuilt Hermes production image.
  • Added coverage to ensure consumers attempting registry writes via --push are rejected, while explicitly using --push=false is allowed.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The sandbox image workflow validator refines Buildx registry-write detection, normalizes shell continuations for Hermes rebuild checks, and adds E2E coverage for prohibited rebuild and registry-push behavior.

Changes

Sandbox image workflow boundary validation

Layer / File(s)	Summary
Buildx boundary detection tools/e2e/sandbox-images-workflow-boundary.mts	Buildx --push matching is refined, and Hermes build detection normalizes shell continuations before checking build commands.
Boundary violation coverage test/e2e/support/sandbox-images-workflow-boundary.test.ts	E2E tests cover Hermes image rebuilding, multiple registry-push flag forms, shell-expanded pushes, and explicit --push=false behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#7508: Updates related Hermes and registry-write validation.
• NVIDIA/NemoClaw#7551: Contains related Buildx and shell-continuation boundary detection changes.

Suggested labels: integration: hermes, area: e2e, area: security

Suggested reviewers: cjagwani, apurvvkumaria, prekshivyas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately reflects the main change: rejecting Hermes consumer builds that continue across lines.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/7551-consumer-continuation-guard

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 2cef897 in the codex/7551-consumer-... branch remains at 96%, unchanged from commit b8ec7a9 in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit 2cef897 in the codex/7551-consumer-... branch remains at 80%, unchanged from commit b8ec7a9 in the main branch.

Show a code coverage summary of the most impacted files.

File	main b8ec7a9	codex/7551-consumer-... 2cef897	+/-
src/lib/policy/...ne-exclusion.ts	97%	92%	-5%
src/lib/onboard...eway-service.ts	81%	82%	+1%
src/lib/actions...dbox/destroy.ts	93%	95%	+2%
src/lib/actions...e-validation.ts	81%	84%	+3%
src/lib/onboard...shboard-port.ts	90%	93%	+3%
src/lib/state/o...oint-migrate.ts	92%	96%	+4%
src/lib/actions...lution-probe.ts	88%	93%	+5%
src/lib/actions...x/mcp-bridge.ts	36%	43%	+7%
src/lib/actions...-add-restart.ts	10%	19%	+9%
src/lib/actions...on-readiness.ts	91%	100%	+9%

---

_{Updated July 26, 2026 04:40 UTC}

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-onboard, credential-sanitization, security-posture

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[apurvvkumaria]

Addressed PRA-1 in e0aa2edb0:

• REGISTRY_WRITE now rejects bare Buildx --push and its truthy assigned Boolean forms, including --push=true, while retaining shell-token boundaries.
• Added the requested regression by injecting docker buildx build --push=true ... into state-dir-guard-metadata and asserting the registry-write violation.

Exact-head verification passed: the focused boundary suite (25/25), changed tests (28/28), Biome, CLI type-checking, commit hooks, and pre-push hooks.

The earlier CLI shard 4 failure is unrelated to this validator change: src/lib/actions/sandbox/mcp-bridge-status-state.test.ts exceeded its existing 5-second timeout. The other seven CLI shards and the static, build/type, security, macOS, WSL, and self-hosted checks passed on the prior head.